CVE-2016-8706

PoC —

CVSS 3.0

8.1 high

EPSS

46%p99

Published

Jan 6, 2017 (Jan 6, 2017)

Modified

Jun 17, 2026

Description

An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Vendors: memcached
Products: memcached
Weakness: CWE-190
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (45.7%)

In the news3 stories

Over 70,000 Memcached Servers Still Vulnerable to Remote Hacking

The Hacker NewsJul 18, 15:52 UTC · Jul 18, 2017Ransomware CVE-2016-8704 CVE-2016-8705 CVE-2016-8706

Memcached - A Story of Failed Patching & Vulnerable Servers

Cisco TalosJul 17, 14:35 UTC · Jul 17, 2017Ransomware CVE-2016-8704 CVE-2016-8706

Multiple Critical Remotely Exploitable Flaws Discovered in Memcached Caching System

The Hacker NewsNov 2, 10:21 UTC · Nov 2, 2016Vulnerability CVE-2016-8704 CVE-2016-8705 CVE-2016-8706